upatre | 4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a

General

Target

4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe
Size

40KB
MD5

a83a09492553df08220b4f460683b6e5
SHA1

b468488bd828f106ce4bf9473f401f3fc4d1344a
SHA256

4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a
SHA512

e3ea8ef53c5446ccdf2f133219af26b06774c2c67ea1b767f3e7b407690e7374df75779a5032b0c74f0943b1aa161fb3f61a6e5a2962503b6f5b2c3959a5831c

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1972	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1660	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe
1660	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1972	1660	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	28
PID 1660 wrote to memory of 1972	1660	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	28
PID 1660 wrote to memory of 1972	1660	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	28
PID 1660 wrote to memory of 1972	1660	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	28

C:\Users\Admin\AppData\Local\Temp\4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe
"C:\Users\Admin\AppData\Local\Temp\4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
40KB

MD5
0cc97835125ea2f951de99da0b3d9913

SHA1
3c60d61b04e6a4dc0dc875b379082606db7b499b

SHA256
92722e12b4002e203d8f9f277e2776449060c1c112bc64174ed9b4dd4cdb3b92

SHA512
a088965a0864906e4bf260de41dd7f6664458ee4fddffe47bcc7be6f917b110d838f4e6a797ee127a8aab479afb3fe5c03ae82fba72eab29cea07ba2e9fbbf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
40KB

MD5
0cc97835125ea2f951de99da0b3d9913

SHA1
3c60d61b04e6a4dc0dc875b379082606db7b499b

SHA256
92722e12b4002e203d8f9f277e2776449060c1c112bc64174ed9b4dd4cdb3b92

SHA512
a088965a0864906e4bf260de41dd7f6664458ee4fddffe47bcc7be6f917b110d838f4e6a797ee127a8aab479afb3fe5c03ae82fba72eab29cea07ba2e9fbbf71

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
40KB

MD5
0cc97835125ea2f951de99da0b3d9913

SHA1
3c60d61b04e6a4dc0dc875b379082606db7b499b

SHA256
92722e12b4002e203d8f9f277e2776449060c1c112bc64174ed9b4dd4cdb3b92

SHA512
a088965a0864906e4bf260de41dd7f6664458ee4fddffe47bcc7be6f917b110d838f4e6a797ee127a8aab479afb3fe5c03ae82fba72eab29cea07ba2e9fbbf71

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
40KB

MD5
0cc97835125ea2f951de99da0b3d9913

SHA1
3c60d61b04e6a4dc0dc875b379082606db7b499b

SHA256
92722e12b4002e203d8f9f277e2776449060c1c112bc64174ed9b4dd4cdb3b92

SHA512
a088965a0864906e4bf260de41dd7f6664458ee4fddffe47bcc7be6f917b110d838f4e6a797ee127a8aab479afb3fe5c03ae82fba72eab29cea07ba2e9fbbf71

Download Submit
memory/1660-54-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing